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• A man pleaded guilty to stealing confidential data from Internet users and then using it to 
drain more than $1.3 million from bank accounts. - Federal Bureau of Investigation (See 
item 6) 

• The outbreak of a rare, typhoidal Salmonella strain that originated in North Carolina’s 
Buncombe County grew to 40 confirmed illnesses May 3. Officials expect that number to 
increase. - Food Safety News (See item 15) 

• A Florida-based crime ring that stole at least $80 million worth of prescription drugs as 
well as goods from warehouses and tractor trailer vehicles, was broken up, federal 
authorities said. - Associated Press (See item 24) 

• The updates to PHP versions 5.3.12 and 5.4.2 released May 3 do not fully resolve the 
vulnerability accidentally disclosed online that allows attackers to execute code on affected 
servers. - H Security (See item 33) 
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Energy Sector 



Current Electricity Sector Threat Alert Levels: Physical: LOW, Cyber: LOW 

Scale: LOW, GUARDED, ELEVATED, HIGH, SEVERE [Source: ISAC for the Electricity Sector (ES-ISAC) - 
rhttp://www.esisac.coml 



1. May 4, Associated Press - (National) Interior sets new drilling rules on public 
land. The U.S. Presidential administration said May 4 it will require companies drilling 
for natural gas on public and Indian lands to publicly disclose chemicals used in 
hydraulic fracturing operations. The proposed “fracking” rules also set standards for 
proper construction of wells and wastewater disposal. The Department of Interior 
secretary said the long-awaited rules will allow continued expansion of natural gas 
drilling while protecting public health and safety. The government maintains the new 
rules, which have been under consideration for a year and a half, reflect industry 
concerns. For instance, the rule on disclosure of chemicals used in fracking was 
softened to allow companies to file reports after drilling operations are completed, 
rather than before they begin, as initially proposed. Industry groups said the earlier 
proposal could have caused lengthy delays. 

Source: http://www.kgwn.tv/story/18146854/interior-sets-new-drilling-rules 

2. May 3, WWJ 62 Detroit - (Michigan) Explosions, fire at Sterling Heights 
substation. A fire followed a series of explosions May 3 at a DTE Energy substation in 
Sterling Heights, Michigan. A spokesman for DTE said the blasts knocked out power to 
about 1,600 homes and businesses in the area. DTE officials were still trying to 
determine what caused the problem. Some traffic lights were out in the area, some at 
major intersections including 18 Mile Road and Van Dyke. 

Source: http://detroit.cbslocal.com/2012/05/03/explosions-fire-at-sterling-heights- 
substation/ 



For another story, see item 12 



T Return to top i 

Chemical Industry Sector 

3. May 3, U.S. Environmental Protection Agency - (Oregon) Portland chemical 

manufacturer failed to publicly disclose data on chemical use. Kanto Corporation, a 
Portland, Oregon chemical manufacturer, failed to report the use of toxic chemicals at 
its facility in violation of community right-to-know laws, according to a settlement with 
the U.S. Environmental Protection Agency (EPA). The firm has agreed to correct 
violations of the federal Toxics Release Inventory Program and pay a fine of $58,200. 
Kanto makes products primarily used in the manufacture of semiconductors. EPA 
found the company used more than 25,000 pounds each of ammonia, hydrogen fluoride 
and nitric acid in 2009, and failed to report information on its use of those chemicals. 
These toxic chemicals can affect the eyes, skin and respiratory system. 

Source: 
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http://vosemite.epa.gOv/opa/admpress.nsf/0/f39de86462eed483852579f3006da01d7Qp 

enDocument 



For more stories, see items 1, 18, and 24 
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Nuclear Reactors, Materials and Waste Sector 

Nothing to report 



[ Return to top ] 

Critical Manufacturing Sector 

4. May 4, WGAL 8 Lancaster - (Pennsylvania) Fire prompts New Holland factory to 
evacuate. The New Holland Agriculture Haytools plant in New Holland, Pennsylvania, 
evacuated its employees, May 3, after a fire started in an air circulation unit. The filters 
inside the units are highly flammable. Firefighters said the fire could have been much 
bigger, but the building was spared by a sprinkler head installed inside the unit itself. 
The sprinkler system held the fire in check until firefighters arrived to completely 
extinguish it. Employees were allowed to go back inside after waiting about 2 hours. 
Source: http://www.wgal.com/news/susquehanna-valley/lancaster/Fire-prompts-New- 
Holland-factorv-to-evacuate/-/9704306/12559854/-/tmdn4f/-/ 

5. May 3, U.S. Department of Labor - (Georgia) Byron, Ga., metal fabricator cited by 
U.S. Department of Labor’s OSHA for combustible residue and other hazards; 
proposed fines exceed $54,000. The U.S. Department of Labor’s Occupational Safety 
and Health Administration (OSHA), May 3, cited Southern Perfection Fabrication 
Holdings Inc. with 15 serious safety and health violations at its Byron, Georgia facility. 
The violations included exposing workers to combustible residues and flammable 
liquids in the spraying and power coating areas without adequate precautions to prevent 
fires and explosions. An inspection of the metal fabrication shop was initiated in 
November 2011 based on a complaint. 

Source: 

http://www.osha.gov/pls/oshaweb/owadisp.show document?p table=NEWS RELEAS 
ES&p id=22326 

T Return to top i 



Defense Industrial Base Sector 

See item 39 
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Banking and Finance Sector 



6. May 3, Federal Bureau of Investigation - (National) Man admits role in $1.3 million 
phishing fraud scheme. A man admitted his role in an Internet fraud ring that stole 
more than $1.3 million after “phishing” confidential account information from Internet 
users, a New Jersey U.S. attorney announced May 3. The man pleaded guilty to one 
count each of wire fraud conspiracy, wire fraud, aggravated identity theft, and 
conspiracy to gain unauthorized access to computers. The ring employed phishing 
attacks using fraudulent Web pages that mimicked the legitimate Web pages of e- 
commerce companies such as banks and payroll processors. Stolen identifiers were 
then used to make unauthorized withdrawals from victims’ accounts. Some of the 
stolen data was used to create fake driver’s licenses for the conspirators to use to 
impersonate victims at bank branches. The man admitted he worked with others to hire 
“soldiers” to go into banks and impersonate real customers using fake licenses made 
with the soldiers’ pictures. The ring also used the information to gain access to online 
accounts, where they could view victim signatures on check images to forge them on 
checks and withdrawal slips. The man admitted he used stolen identifiers to intercept 
and respond to e-mails to impersonate real account holders. He also admitted he 
impersonated company payroll officers in conversations with ADP, a national payroll 
processing company. Chase Bank, Bank of America, ADP, and Branch Bank & Trust 
Co. together lost about $1.3 million to the fraud ring. 

Source: http://www.ahherald.com/newsbrief-mainmenu-2/law-and-order/13094-man- 
admits-role-in- 13-million-phishing- fraud-scheme 

7. May 3, Chicago Tribune - (Illinois) Justice Department indicts seven on mortgage 
fraud. The U.S. Department of Justice announced indictments May 3 against seven 
people, including a Chicago police officer who allegedly committed mortgage fraud 
involving Chicago condominium buildings between 2006 and 2008. The alleged fraud 
involved illegally obtaining 35 mortgages that totaled more than $8.8 million from 
various lenders. According to the indictment, one of the men purchased four condo 
units in the city’s Bronzeville neighborhood, and with help from other defendants, 
allegedly fraudulently qualified to receive mortgage loans from four different banks 
that totaled almost $622,000. He then received payments from another man indicted in 
the scheme, the indictment stated. Two of the conspirators allegedly were each 
involved in the separate, fraudulent purchase of eight condo units. Two other were 
charged with allegedly helping the buyers secure the fraudulent loans. In 2010, the 
Illinois Department of Financial and Professional Regulation announced a series of 
disciplinary actions against manyl companies and individuals, some of whom are 
named in the indictment, related to a mortgage fraud investigation involving a 27 -unit 
building. At the time, all of the units were in foreclosure. 

Source: http://articles.chicagotribune.com/2012-05-03/business/chi-iustice-department- 
indicts-7-on-mortgage-fraud-20 120503 1 mortgage-fraud-straw-buyers-mortgage- 
loans 



8. May 3, Federal Bureau of Investigation - (Illinois) ‘ I n vestFor Closu res ’ operator 
pleads guilty to $7 million mail fraud scheme. A man pleaded guilty May 3 in federal 
court in Rockford, Illinois, to conducting a $7 million mail fraud scheme. The 
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defendant co-owned and operated a business, known as InvestForClosures, with his 
business partner. In his plea, the man admitted he fraudulently obtained more than $7 
million from investors. According to the plea agreement, he represented to potential 
investors that the business bought distressed houses, rehabilitated those houses, and 
sold them for a profit. He admitted in his plea that he and his employees made various 
representations to potential investors, including: their investments would be safe 
because they would be backed by real estate; InvestForClosures used the majority of 
investors funds to purchase real estate; and because of the business’ efficient cash flow 
from buying and selling houses, InvestForClosures Financial never failed to make an 
interest payment on time or return an investor’s principal when requested. He admitted 
that each of these representations was false. About $1,711,711.18 of the approximately 
$7,238,506.40 fraudulently obtained from investors was paid back through Ponzi-type 
payments. 

Source: http://www.loansafe.org/investforclosures-operator-pleads-guilty-to-7-million- 
mail-fraud- scheme 



9. May 3, Baltimore Sun - (Maryland) Builder pleads guilty in investment scheme. A 
Baltimore home builder pleaded guilty May 3 in connection with a construction 
investment scheme that defrauded victims of more than $14 million, the Maryland U.S. 
attorney’s office said. The defendant spent at least 2 years — from 2009 to 201 1 — 
targeting people with money to invest in construction projects or who needed financing 
for their own projects, including a hotel in Bowie, Maryland. The defendant told the 
investors to put “large sums of money” in an escrow bank account to prove liquidity for 
purposes of getting financing, and that they would receive a high rate of return for their 
efforts, according to his plea agreement. Instead, the defendant and co-conspirators 
“fraudulently” removed the money — typically within 2 weeks — to pay off debts or to 
make “lulling” payments to other victims. A co-defendant, an attorney from Phoenix, 
also pleaded guilty The defendant operated several companies, including the 
McCloskey Group LLC and Kellen Property & Investment LLC. 

Source: http://articles.baltimoresun.com/2012-05-Q3/business/bs-bz-construction- 
investment-scheme-20 120503 1 investment-scheme-lulling-payments-home-builder 
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Transportation Sector 

10. May 4, Marin Independent Journal - (California) SFO: Terminal 3 cleared due to 
unauthorized access. Terminal 3 at San Francisco International Airport was cleared 
after an unauthorized access to the terminal, an airport spokesman said. A person 
gained access to the terminal because of a “procedure breakdown,” May 4. Everyone in 
the United Airlines domestic terminal was cleared, and had to go through security 
screenings again to reenter the terminal. The evacuation caused long lines at security 
checkpoints. The spokesman said airport officials were interviewing the person who 
entered the terminal. 

Source: http://www.marinii.com/ci 20547963/sfo-terminal-3-cleared-due- 
unauthorized-access 
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11. May 4, Gonzales Cannon - (Texas) Bomb threat derails train in Harwood. A bomb 
threat was called in to the Gonzales County, Texas, Sheriffs Office by a passenger on 
Amtrak train #213, which had departed from San Antonio and was bound for New 
York City, May 4. The man said he had a bomb in his possession and authorities 
stopped the train near the intersection of Lockhart Street and Highway 90 near the 
Harwood community. The man was taken into custody and transported to a county jail. 
Authorities made a check of his luggage where there was reportedly a large bag of 
medications, including several generally prescribed for psychotics, and a 4-page 
manifesto. After a search of about 1 hour, the passengers were allowed to return to the 
train. Several law enforcement agencies responded to the scene including the 
department of public safety, the Bureau of Alcohol, Tobacco, Firearms and Explosives, 
the DHS, and the FBI. 

Source: http://www.gonzalescannon.com/node/9402 

12. May 3, WJHG 7 Panama City - (Florida) Port Panama City fire contained. While 
there were no open flames in the building at Port Panama City in Florida, which caught 
fire May 2, fire officials were still working to completely extinguish all the hot spots 
May 3. The Panama City Port Authority owns the building but it is used by Green 
Circle Energy Plant, of Cottondale, where it manufactures and ships wood pellets. The 
pellets are extremely flammable and fire officials believed the blaze started on the 
conveyor belt used to move the pellets from one building to another. Fire officials 
quickly contained the blaze, but the building was not considered fire-free as of late the 
afternoon of May 3. The building and equipment inside were estimated to be worth $13 
million. Fire officials said the building appeared structurally sound. 

Source: 

http://www.wjhg.com/news/headlines/Port Panama City Fire Contained .html?ref =73 
5 

For more stories, see items 24 , 26 , 41 , and 42 
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Postal and Shipping Sector 

13. May 3, WWBT 12 Richmond - (Virginia) Teens charged for Chesterfield mailbox 
bombs. Four teens face charges for blowing up mailboxes in Chesterfield County, 
Virginia. The event happened early May 3 in the Brandy Oaks neighborhood. 
Neighbors reported hearing loud explosions about 2:30 a.m. Police responded and 
stopped a car with four teens in it. Police said the teens had what looked like materials 
to make bottle bombs. After driving through the neighborhood, the officers found 13 
mailboxes damaged and multiple bottle bombs that exploded. 

Source: http://www.nbcl2.com/storv/18132738/teens-charged-for-chesterfield- 
mailbox-bombs 



[ Return to top ] 
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Agriculture and Food Sector 



14. May 4, Food Safety News - (South Carolina; National) Tainted dog food sickens 14 
people. Fourteen people were sickened with Salmonella Infantis infections in a 9-state 
outbreak linked to dog food, Food Safety News reported May 4. At least five of the 
individuals were hospitalized, according to the Centers for Disease Control and 
Prevention (CDC). The CDC reported May 3 that multiple brands of Diamond Pet 
Foods dry dog food — including several recalled the week of April 30 — were the 
likely source of the human illnesses, either through contact with the contaminated food 
or through handling an animal that ate the tainted kibble. The dog food was produced at 
a single manufacturing plant in South Carolina. Routine tests by the Michigan 
Department of Agriculture first detected Salmonella in an unopened bag April 2. 
PulseNet then spotted several cases of human Salmonella Infantis infections with a 
genetic fingerprint identical to that found in the dog food. Missouri and North Carolina 
each confirmed three cases related to the dog food outbreak. Ohio reported two cases 
while Alabama, Connecticut, Michigan, New Jersey, Pennsylvania, and Virginia each 
reported single cases. 

Source: http://www.foodsafetvnews.com/2012/05/salmonella-tainted-dog-food-sickens- 
14-people/ 

15. May 4, Food Safety News - (North Carolina; National) Rare Salmonella Paratyphi 
outbreak grows as investigation continues. The outbreak of a rare, typhoidal 
Salmonella strain that originated in North Carolina’s Buncombe County grew to 40 
confirmed illnesses May 3 as the State and county health departments continued their 
investigation and anticipate additional infections will surface. According to a 
Buncombe County Department of Health spokeswoman, many of those sickened 
contracted their infections through person-to-person contact. April 30, Smiling Hara 
recalled 12-ounce packages of unpasteurized tempeh as a cautionary measure after a 
sample of the company’s soybean tempeh tested positive for Salmonella. The tempeh 
remains a potential outbreak source until further tests. More than half of the cases 
involve individuals who said they did not consume tempeh during the outbreak 
window, the health spokeswoman said. The health departments continue to investigate 
other potential sources, she said, though it is clear that infections have come from 
“several different routes of transmission.” Illnesses were reported in North Carolina, 
South Carolina, Tennessee, and New York. 

Source: http://www.foodsafetvnews.com/2012/05/rare-salmonella-paratyphi-outbreak- 
grows-as-investigation-continues/ 

16. May 4, U.S. Food and Drug Administration - (Texas) H-E-B issues a precautionary 
recall for Asian Ready-to-Eat meals due to possible health risk. H-E-B issued a 
voluntary and precautionary recall for certain Asian Ready-to-Eat meals due to the 
possibility of undercooked chicken in those meals, U.S. Food and Drug Administration 
reported May 2. The recall involves 19 Ready-to-Eat entrees and meals sold in 40 
stores in Texas. 

Source: http://www.fda.gov/Safety/Recalls/ucm302903.htm 
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17. May 3, FoodQualityNews.com - (International) PepsiCo recalls Tropicana OJ after 
‘microbiological contamination’ dispatch error. PepsiCo UK initiated a recall of 
Tropicana Kids Orange Juice Drinks over fears the cartons contain potentially 
hazardous water rather than the typical orange juice blend, Food Quality News reported 
May 3. Nearly 300 units of Tropicana Kids Orange Juice Drinks multi-packs were 
recalled by the firm after it emerged that water in the packs was of an “unsatisfactory 
quality due to microbiological contamination.” In a statement sent to Food Quality 
News, a PepsiCo spokesperson attributed the error to the accidental dispatch of samples 
from a production test procedure using water that was not up to the firm’s usual 
standards. 

Source: http://www.foodqualitvnews.com/Food-Alerts/PepsiCo-recalls-Tropicana-OJ- 
after-microbiological-contamination-dispatch-error 

For another story, see item 44 
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Water Sector 



18. May 4, Harrisburg Express-Times - (New Jersey) Pohatcong Valley Superfund site 
water could increase cancer risk. The New Jersey Department of Health and Senior 
Services said May 3 that groundwater at the Pohatcong Valley Groundwater 
Contamination Superfund Site is safe for people who use public or treated water, 
however, untreated private water could increase the risk of cancer and birth defects. 

The aquifer that supplies Washington and Fran kl in townships in Warren County, is 
contaminated with tetrachloroethylene and trichloroethylene, according to a state health 
department news release. The impact of that contamination differs depending on 
treatment of the water. Public water sources and private wells filtered with a point-of- 
entry treatment system are safe, but unfiltered water in the region could have risks. 
There are about 48 homes in the three townships that used private wells exposed to 
trichloroethylene before connection to public water services in 1981 or installation of 
point-of-entry systems in 2002. The Franklin Township mayor said the oversight from 
the state and federal governments has been very responsible. She noted that part of the 
township is hooked up to New Jersey American Water, meaning those residents are 
safe from the problem. 

Source: http://www.lehighvallevlive.com/warren-county/express- 
times/index.ssf/2012/05/warren county superfund site w.html 

19. May 3, Mobile Press-Register - (Alabama) Baldwin County sewage spills 
reported. The Baldwin County, Alabama Health Department reported May 3 that two 
sewage spills occurred in the county due to heavy rainfall. Officials said a lift station in 
Robertsdale overflowed and resulted in an estimated 30,000 gallons of sewage 
discharging into Rock Creek. Reports indicate a lift station overflow in Daphne, 
resulting in 2,000 gallons of sewage being discharged into Yancey Branch. 

Source: http://blog.al.com/live/2012/05/sewage spills reported in robe.html 
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20. May 3, WTMJ 4 Milwaukee - (Wisconsin) DNR warns water is unsafe to drink near 
power plant. The Wisconsin Department of Natural Resources (DNR) sent two dozen 
families in Caledonia, Wisconsin, letters saying the water from their well was not safe 
for drinking, WTMJ 4 Milwaukee reported May 3. Testing of samples from the fall 
201 1 revealed high levels of boron and molybdenum. A DNR hydrogeologist said the 
molybdenum could be naturally high in the area, however, the agency is investigating 
the We Energies plant as a possible source of the contamination. They are also looking 
at an old landfill which, by federal standards, is filled with hazardous chemical waste 
and has been designated as EPA superfund site. It was the target of much 
environmental concern November 201 1 after it collapsed into Lake Michigan. We 
energies is paying for bottled water to be delivered to residents but said that is not an 
acknowledgment that its plant is polluting the water. We Energies paid for a study that 
found the groundwater flows away from the neighborhoods with the problems. The 
DNR expects test results back from its water samples in May. The agency plans to 
release its findings late summer. 

Source: http://www.todavstmi4.com/features/iteam/150093905.html 

21. May 2, ClimateWire - (Connecticut) Rising groundwater may flood underground 
infrastructure of coastal cities. Pipes, sewers, and basements beneath the coastal city 
of New Haven, Connecticut, could be flooded by rising groundwater by the end of the 
century, according to a preliminary study from Yale University and the U.S. Geological 
Survey (USGS) released May 1. Much of the city’s downtown is less than 30 feet 
above sea level, and advancing waters in the Atlantic could raise groundwater levels as 
much as 3 feet near the shoreline, the report said, with the potential to “inundate 
underground infrastructure.” Groundwater has risen by as much as 4 feet over the past 
100 years in the region, partially because the waters are no longer being used for 
industrial purposes as they were in the early 1900s. Impacts of another 3- to 4-foot rise 
in groundwater level is unclear, but many of the city’s water mains are below the water 
table, said the vice president of water quality and outreach for the South Central 
Connecticut Regional Water Authority. Because groundwater near the coast is salty, it 
speeds up pipe corrosion. “Rising groundwater levels are expected to be a chronic 
problem and will likely be a major issue for all large cities along the coast in the 
future,” said a USGS hydrologist and lead author of the report. 

Source: http://www.scientificamerican.corn/article.cfm?id=rising-groundwater-may- 
flood-underground-infrastructure-of-coastal-cities 

For another story, see item 44 
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Public Health and Healthcare Sector 



22. May 4, McKnight’s Long-Term Care News - (West Virginia) Gun-toting clown robs 
nursing home. Two Hurricane, West Virginia nursing home nurses were safe May 4 
after being held up at gunpoint by a man dressed as a clown. The man broke into the 
Teays Valley Center, a skilled nursing and rehabilitation facility owned by Genesis 
Healthcare May 2. He demanded prescription drugs from the nurses and left quickly. 
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Police were still looking for him as of May 3. A Genesis spokeswoman said all 
residents were in their rooms during the break-in, and none were involved in the 
incident. She said the company was “extremely concerned” and studying extra 
measures to try to prevent a similar incident. 

Source: http://www.mcknights.com/gun-toting-clown-robs-nursing- 
home/article/239599/ 

23. May 4, Associated Press - (Washington) Wash, uses emergency cash to curb 
whooping cough. The governor of Washington opened an emergency fund May 3 to 
help contain a spreading whooping cough epidemic, and officials urged residents to get 
vaccinated against the illness that particularly threatens infants. He was making 
$90,000 in crisis cash available to help strengthen a public awareness campaign about 
the need for the pertussis vaccination. The State health department is already looking to 
spend about $200,000 on the effort. The State has also received approval from the 
federal government to divert some federal cash toward the purchase of 27,000 doses of 
the whooping cough vaccine. Those will be available for uninsured residents. 
Washington has already recorded 1,132 cases of whooping cough in 2012 — about 10 
times more than the same time last year, according to disease investigators at the health 
department. The State is recording more than 400 cases of pertussis each month — four 
times more than the threshold that State officials consider “epidemic” levels — and 
Washington is on pace for as many as 3,000 cases in 2012. 

Source: http://www.usatoday.com/news/health/story/2012-05-04/whooping-cough- 
Washin gton/5 4743924/1 

24. May 3, Associated Press - (Connecticut; Florida; New Jersey) Feds break up major 
Florida-based drug theft ring. A Florida-based crime ring that stole at least $80 
million worth of prescription drugs, including pulling off one of the nation’s biggest 
heists in Connecticut in 2010, was broken up following a 3-year undercover FBI probe, 
federal authorities said May 3. A total of 22 people were charged by federal authorities 
in New Jersey, Connecticut, and Miami, where the group was based, a Miami U.S. 
attorney said. The thieves hit warehouses and stole tractor-trailers around the country, 
often from highway rest stops, and brought the drugs to South Florida and New Jersey 
in an attempt to sell them. The medications included antidepressants, anti-psychotics, 
and treatments for cancer, acne, epilepsy, arthritis, and autoimmune disorders, and even 
aspirin and Flintstones children’s vitamins, authorities said. “This investigation 
represents the largest takedown in U.S. history involving cargo theft,” the chief of the 
Miami FBI office said. Besides the drugs, the U.S. attorney said the ring stole more 
than $20 million in other goods, including thousands of bottles of Johnnie Walker 
Scotch whiskey, thousands of cases of cigarettes from an Illinois warehouse, 64,000 
cell phones, and 200 inflatable boats. 

Source: http://www.kfvs 12.eom/story/l 8 1 1 5300/feds-break-up-major-florida-based- 
drug-theft-ring 

25. May 3, Reuters - (National) FDA says number of new drug shortages down. Health 
officials said the number of new shortages of crucial drugs used to treat cancer and 
other illnesses had been halved compared to a year ago, and they attributed the 
improvement to earlier notice from drugmakers about looming supply issues. There 



- 10 - 



have been 42 newly scarce drugs so far in 2012, compared to 90 in the same period a 
year ago, the U.S. Food and Drug Administration (FDA) Commissioner said May 3 on 
the agency’s Web site. Efforts to combat shortages escalated in 2011 when 250 
medicines were in short supply, up from 56 in 2006. Some doctors have had to 
postpone care or use second-best drugs or more costly alternatives to compensate for 
shortages. According to an FDA list, which is updated daily, there are currently about 
120 drugs regarded as being in short supply. 

Source: http://www.sun-sentinel.com/health/sns-rt-us-fda-shortagesbre8421hg- 
20120503,0,3898795.story 

26. May 3, San Bernardino County Sun - (California) Man arrested after bomb scare at 
Loma Linda hospital emergency room. Security officers at Loma Linda University 
Medical Center in Loma Linda, California, contacted the sheriff’s department after a 
man walked into the emergency room claiming he had an explosive device attached to 
his body and asked for help. At that time, hospital security escorted the man out of the 
hospital. He was taken to a nearby enclosed concrete parking structure. The device, 
which had wires, was X-rayed and removed from the man. Sheriff’s bomb and arson 
personnel determined it was not an explosive. Live agencies responded. The hospital 
had a plan in place for handling patients when a significant incident occurs, officials 
said. It followed the Inland Counties Emergency Medical Agency’s master plan for San 
Bernardino and Riverside counties. The hospital’s ER was closed while clinical areas 
remained open to staff, said a hospital spokesman. ER patients were moved to the front 
of the hospital, and new ER patients were diverted to other hospitals. The lobby was 
partially evacuated, though all floors of the hospital remained open. Authorities closed 
nearby Barton Road and Campus Street. Fire trucks and police vehicles lined the street 
in front of the ER. 

Source: http://www.sbsun.com/ci 20538539/deputies-assist-possible-suspicious- 
device-at-llumc 
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Government Facilities Sector 



27. May 4, WFMZ 69 Allentown - (Pennsylvania) Exeter Twp. School district, police 
dealing with rash of bomb threats. A bomb threat May 3 disrupted the school day for 
Exeter Township Senior High School students and teachers in Exeter Township, 
Pennsylvania, for the third time in the past week. The school’s 1,400 students were 
evacuated from the building to the nearby football stadium while township and state 
police swept the building, said the school’s principal. The May 3 bomb threat was 
discovered written on a desk in black magic marker, investigators said. Police 
explained the pranks are draining their resources. They said the person or people 
behind the bomb threats will face a list of charges, including risking a catastrophe and 
making terroristic threats. 

Source: http://www.wfmz.com/news/news-regional-berks/Exeter-Twp-School-district- 
police-dealin g- with-rash-of-bomb-threats/V 121418/1 25404 1 8/-/el7 a5 8/-/ 
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28. May 3, Associated Press - (Tennessee) 2 arrested after 2 bottles explode at high 
school. Police in Memphis, Tennessee, said two students were taken into custody May 
3 after two chemical-filled bottles exploded at a Memphis high school. Memphis police 
said in a news release that two students of Craigmont High School were charged with 
aggravated assault, felony reckless endangerment, and possession of a prohibited 
weapon. The high school was evacuated earlier May 3 in what school authorities called 
a prank explosion. Officials said an assistant principal with asthma went to the hospital 
after inhaling smoke produced by the mixture. Police said a bomb threat was called in 
to the school beforehand. 

Source: http://www.tri-cityherald.com/2012/05/03/1926671/prank-explosion-clears- 
memphis.html 

29. May 3, Vermont Public Radio - (Vermont) Suspicious package turns out to be 
musical greeting card. Police said a suspicious package that prompted the evacuation 
of hundreds of workers May 3 at the U.S. Citizenship and Immigration Services 
building in St. Albans, Vermont, was a musical greeting card. Mailroom employees 
found the package and deemed it suspicious after it was X-rayed. Officials said the 
package appeared to be wire-like. About 800 employees were evacuated, as well as a 
nearby day care. A bomb squad robot was sent into the building to inspect the package. 
Police said normal operations resumed later the same day. 

Source: http://www.vpr.net/news detail/94385/suspicious-package-tums-out-to-be- 
musical-greetin/ 

30. May 3, WABC 7 New York - (New Jersey) 3 students, 2 teachers sickened at NJ 
Islamic school. Authorities were unable to determine what sickened two teachers and 
three students May 3 at an Islamic school in South Brunswick, New Jersey. The 
approximately 200 students at Noor-Ul-Iman were evacuated after the students 
suddenly fell ill. “They complained about stomach and turned blue,” said a South 
Brunswick police sergeant. The school closed for the day. The police sergeant said the 
school has hired an air quality company to check the building. 

Source: 

http://abclocal.go.com/wabc/storv?section=news/local/new jersey&id=8646926 

31. May 3, Casper Star Tribune - (Wyoming) Fire closes Midwest School. A fire May 3 
in a classroom at Midwest School in Natrona County, Wyoming, injured one student 
and forced officials to close the school for the remainder of the day. Officials evacuated 
students to a nearby church and the town hall. A media release from the Natrona 
County School District noted that one student was “being treated for a chemical bum.” 
Source: http://trib.com/news/local/casper/fire-closes-midwest-school/article 78a8976a- 
0117-5235-9521-c25fa0f6fa0c.html 



For another story, see item 42 
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Emergency Services Sector 



32. May 3, Charleston Gazette - (West Virginia) Two men face charges in theft of 
copper from police phone lines. State police troopers arrested two men May 1 who 
allegedly stole copper from a State police detachment in Boone County, West Virginia. 
A State police sergeant said troopers began investigating a copper theft from phone 
lines at the StatepPolice detachment in Whitesville. The investigation led troopers to 
the two suspects, he said. Police charged the men with interruption of telephone 
service, grand larceny, and conspiracy to commit a felony. The theft caused about 
$25,000 in damage and disrupted phone service for the detachment and community for 
nearly 2 days, the sergeant said. 

Source: http://sundavgazettemail.com/News/201205030129 
For more stories, see items 26 , 39 , and 40 
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Information Technology Sector 

33. May 4, H Security - (International) PHP patch quick but inadequate. The updates to 
PHP versions 5.3.12 and 5.4.2 released May 3 do not fully resolve the vulnerability 
accidentally disclosed online, according to the flaw’s discoverer. The bug in the way 
CGI and PHP interact with each other leads to a situation where attackers can execute 
code on affected servers. The issue remained undiscovered for 8 years. Currently, the 
best protection requires setting up filter rules on the Web server. However, the 
RewriteRule workaround described on PHP.net is also inadequate. The discoverer 
suggests a slightly modified form of the rule as an alternative. Because the PHP 
interpreter for CGI does not comply with the specifications laid out in the CGI 
standard, URL parameters can, under certain circumstances, be passed to PHP as 
command line arguments. Servers which run PHP in CGI mode are affected; FastCGI 
PHP installations are not. The PHP patch is supposed to ensure parameter strings 
beginning with a minus sign, and which do not contain an equals sign, are ignored. 
According to the discoverer, this can be bypassed easily. A new, slightly modified 
patch which uses query_string instead of decoded_query_string for one comparison 
was already submitted to the bug tracking system. Users can determine whether they 
are affected by the bug by appending the string ?-s to a URL. If the server returns PHP 
source code, rapid action is required. A Metasploit module that opens a remote shell for 
executing arbitrary code on vulnerable servers is already available. 

Source: http://www.h-online.com/security/news/item/PHP-patch-quick-but-inadequate- 
1568454.html 



34. May 4, H Security - (International) VMware address critical issues in Workstation, 
Player, ESXi and ESX. VMware has published a security advisory that addresses 
critical security flaws in the company’s Workstation, Player, Fusion, ESXi, and ESX 
products. There are five flaws detailed in the advisory. ESX 3.5 to 4.1 and ESXi 3.5 to 
5.0 are affected by a host memory overwrite vulnerability in the handling of RPC 
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commands and data pointers that means a guest user could crash a VMX process. 
VMware notes the issue can be worked around by configuring virtual machines that use 
less than 4GB of memory. The workaround though is not an effective remedy for a 
similar issue with RPC and function pointers. Both issues could be exploited without 
root/administrator access. Another issue, again only affecting ESX and ESXi, means a 
flaw in the handling of NFS traffic can overwrite memory and can be used to execute 
code on an ESX/ESXi system without authentication; however the issue only occurs 
with NFS traffic. A floppy device out-of-bounds memory write and an unchecked SCSI 
device memory write issue both affect Workstation 8.x, Player 4.x, and Fusion 4.x, as 
well as ESXi and ESX; removing the virtual floppy drive or SCSI device from virtual 
machines will work around the problem. Both issues require root/administrator access 
to exploit. 

Source: http://www.h-online.com/security/news/item/VMware-address-critical-issues- 
in-Workstation-Player-ESXi-and-ESX-1568119.html 



35. May 4, H Security - (International) Adobe Flash Player update closes critical object 
confusion hole. Adobe released a security advisory relating to an object confusion 
vulnerability that allows an attacker to crash its Flash Player or take control of an 
affected system. Adobe said there are reports of this vulnerability being exploited in the 
wild as part of targeted e-mail-based attacks that trick the user into clicking on a 
malicious file; this exploit only targets Flash Player on Internet Explorer on Windows, 
though the vulnerability exists on Windows, Mac OS X, Finux, and Android versions 
of the player. An update to Adobe Flash Player 11.2.202.235 on Windows, Mac OS X, 
and F inux should be applied by any user running version 1 1.2.202.233 or earlier. 
Source: http://www.h-online.com/securitv/news/item/Adobe-Flash-Player-update- 
closes-critical-object-confusion-hole-1568704.html 

36. May 3, Government Computer News - (International) 105 Top Level Domain 
applicants had info exposed. The Internet Corporation for Assigned Names and 
Numbers (ICANN) began notifying 105 applicants for new generic Top Fevel Domains 
(gTFDs) that some of their information was exposed through a glitch in the online 
application system. The system was taken offline April 12, which was to be the closing 
day for applying for new gTFD names, and remained offline for 3 weeks. At some 
point after the notifications are complete, ICANN will announce the reopening of the 
system and a new deadline for filing applications. ICANN’ s chief security officer said 
there is no indication the problem was the result of a malicious intrusion or that any 
information other than some user names and file names was exposed. The system was 
taken offline through an abundance of caution, he said. 

Source: http://gcn.com/articles/2012/05/03/icann-new-gtld-105-applicants-info- 
exposed.aspx 

37. May 3, ZDNet - (International) Microsoft kicks Chinese company out of 
vulnerability sharing program. Microsoft removed a Chinese security company from 
its Microsoft Active Protections Program (MAPP) vulnerability information sharing 
program following a recent leak of proof-of-concept code for a serious security hole in 
all versions of Windows. Microsoft identified the company as Hangzhou DPTech 
Technologies Co., Ftd, a Chinese outfit that describes itself as a “high-tech company 
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integrating research and development, manufacturing and sales in the network security 
industry.” After an investigation into the proof-of-concept leak, Microsoft said 
Hangzhou DPTech Technologies breached the strict non-disclosure agreement meant to 
ensure sensitive data does not fall into the wrong hands. 

Source: http://www.zdnet.com/blog/securitv/microsoft-kicks-chinese-company-out-of- 
vulnerability-sharing-program/1 1853 

38. May 3, MSNBC - (International) Infected users get legit warning about July 9 
‘Internet Doomsday’. Two companies, OpenDNS and CloudFlare, have put together a 
message alert system to help more than a half-million U.S. users who are believed to 
have the DNSChanger malware on their computers and do not know it, and who may 
not have heard about it in recent weeks. Infected users will see a message appear on 
their computer screen. The message says, in part, that the user’s Domain Name Server 
settings suggest “you probably have the DNSChanger malware.” Users are then 
directed to an OpenDNS Web site which has instructions on how to switch DNS to 
OpenDNS’s trusted servers. The message also has a link to the FBI’s Web site for more 
information. 

Source: http://www.technolog.msnbc.msn.com/technology/technolog/infected-users- 
get-legit-warning-about-iulv-9-intemet-doomsday-7 51078 

39. May 3, InformationWeek - (International) Anonymous, LulzSec case in U.S. 
expanded by feds. A federal grand jury handed down a superseding indictment in the 
case against alleged LulzSec and Anonymous leaders that adds a sixth person to the list 
of people charged, InformationWeek reported May 3. The revised indictment now lists 
a man, known as Anarchaos, bum, POW, ghost, and anarchaker, amongst other aliases, 
as a defendant, and accuses him of participating in LulzSec and Anonymous hacks 
involving the Web sites of the Arizona Department of Public Safety, and Stratfor. 
Source: http://www.informationweek.com/news/securitv/government/232901400 

For more stories, see items 3 and 6 

Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at sos@us-cert.gov or 
visit their Web site: http://www.us-cert. gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: https://www.it-isac.org 
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Communications Sector 



40. May 4, Aspen Times - (Colorado) Major phone problems hit Pitkin County. Land- 
based phone lines and some cellphone services went down across Pitkin County, 
Colorado, May 3. The extent of the outage, which started around 9:30 p.m., was 
unknown, according to a statement from the county. All non-emergency and 9-1-1 lines 
for the 9-1-1 Center in Aspen were down. Emergency calls were rerouted to Vail Public 
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Safety Communications. Century Link was aware of the problem and worked to resolve 
the issue late May 3. 

Source: 

http://www.aspentimes.com/article/20120504/NEWS/120509946/1077&ParentProfile= 

1058 



For more stories, see items 32, 35, 36, and 38 
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Commercial Facilities Sector 

41. May 4, Associated Press - (Michigan) Flooding in Flint area forces residents from 
homes. Firefighters in the Flint, Michigan area used a boat to get people out of 
apartments and townhouses after floodwaters following heavy rains left people trapped 
in their homes May 4. The Flint Journal reported buildings were evacuated in Grand 
Blanc Township following heavy rains May 3-4. Flooding also caused problems for 
motorists, closing some roadways in the Detroit and Flint areas. Nearly a dozen cars 
were stranded and northbound Interstate 75 was closed May 4 in Flint Township, with 
up to 4 feet of water on the roadway. 

Source: http://www.mlive.com/newsflash/index.ssf/storv/flooding-in-flint-area-forces- 
residents-from-homes/967cceb222b34d6c897cca05138e4697 

42. May 4, Oakland Tribune - (California) Emeryville: Fuel leak at AC Transit yard 
forces evacuations at Pixar, school. Several businesses and a high school were 
evacuated as a precaution, May 4, following a hydrogen fuel tank leak at an AC Transit 
bus yard in Emeryville, California. Pixar Studios, Emery Bay Village, and Emery 
Secondary School were among the buildings evacuated after a pop and large fireball 
was reported. After the report, the Emeryville Fire Department ordered an immediate 
evacuation of businesses in the area. An AC Transit spokesman said a hydrogen storage 
tank began venting for an unknown reason and that technicians were working to 
determine the cause. 

Source: http://www.mercurynews.com/breaking-news/ci 20548592/emeryville- 
emergency-crews-respond-possible-fuel-tank-leak 

43. May 4, WMAR 2 Baltimore - (Maryland) Two women found shot inside 

church. Police were investigating the shootings of two women inside an Ellicott City, 
Maryland church, May 3. Police responded to St. Peter’s Episcopal Church when a 
church custodian called 911 to report that he found two women who had appeared to 
have been shot inside an office at the church. One woman was pronounced dead at the 
scene. The other was taken to a hospital. Police found a man’s body in the woods close 
to the church. The man was dead - from what appeared to be a self-inflicted gunshot 
wound. A gun was also located near the body. 

Source: 

http://www.abc2news.com/dpp/news/crime checker/howard county crime/two- 
women-found- shot-inside-church 
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44. May 4, Roanoke Times - (Virginia) Blacksburg Country Club to pay $19,000 over 
spill, fish kill. The Blacksburg Country Club in Blacksburg, Virginia, agreed to pay 
nearly $19,000, in addition to financing an environmental restoration project, to make 
amends for a chemical spill that killed thousands of fish, the Roanoke Times reported 
May 4. The agreement reached in federal court was the latest regulatory action to come 
from a 2007 accident that dumped herbicides into the North Fork of the Roanoke River, 
killing about 10,000 fish. In July 2007, a club employee was mixing three herbicides 
with water to treat the golf course when he briefly walked away from a 150-gallon 
sprayer that was being filled with a water hose. When he returned, he found the water 
and chemicals had overflowed onto a concrete pad. Workers sprayed the equipment and 
concrete pad down with water to clean it, unaware that a drainage pipe was dumping 
the mixture directly into the river. 

Source: http://www.roanoke.com/news/roanoke/wb/308349 

45. May 3, Pekin Daily Times - (Illinois) Meth lab prompts motel evacuation. Reports of 
a domestic disturbance led East Peoria, Illinois police to a motel, May 3, which they 
evacuated when a methamphetamine lab was found in one of the rooms. Police arrested 
a man and a woman in connection with the meth lab at the Super 8 Motel. The meth lab 
prompted the city fire department and a special meth response team with the Il linois 
State Police to respond and assist police in evacuating the motel, according to a news 
release. 

Source: http://www.pekintimes.com/news/xl018079982/Meth-lab-prompts-motel- 
evacuation 



46. May 3, Columbia Patch - (Maryland) Fire breaks out near Sears at mall in 
Columbia. A fire broke out in a trailer located near the Sears at a mall in Columbia, 
Maryland, May 3, according to Howard County fire officials. Smoke poured into the 
interior of Sears causing extensive damage. The trailer was reportedly attached to a 
loading dock. The fire was under control after about 2.5 hours. An airboat from 
Montgomery County was requested to assist with ventilating the mall to remove smoke. 
A mall spokesperson said the mall would open at its normal opening time. 

Source: http://columbia.patch.com/articles/fire-breaks-out-near-sears-at-columbia-mall 

47. May 3, WHP 21 Harrisburg - (Pennsylvania) Man seals off hotel room, mixes 
chemicals to commit suicide. Police in Swatara, Pennsylvania, were called to a Super 
8 motel on the report of a suspicious odor, May 3, and discovered a room sealed shut 
with duct tape. When officers were unable to contact the occupant, they feared toxic 
materials were used in the room. Officers evacuated the motel and requested fire, EMS, 
and HAZMAT crews. After entering the room, officers discovered the room’s occupant 
had mixed several chemicals to create toxic fumes to commit suicide. The man did not 
survive. The scene was decontaminated, as were members of the responding agencies. 
Source: http://www.whptv.com/news/local/story/Man-seals-off-hotel-room-mixes- 
chemicals-to/oIpnx8LYpEC6nRaVIFcrIQ.cspx 



48. May 3, Northwest Cable News - (Washington) Tacoma day care arson draws federal 
investigators. Investigators from the FBI and the Bureau of Alcohol, Tobacco, 
Firearms and Explosives were looking into a fire at a day care center in Tacoma, 
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Washington, May 3. The fire came a day after a van was rammed into the building by 
someone who put a rock on the gas pedal of the vehicle. The fire at Pathways to 
Learning Child Care was put out quickly by the sprinkler system and damage was 
minor. Firefighters at the scene found a broken window and a gas can inside. The day 
care was closed for the rest of the day. It is affiliated with the Church of God in Christ 
International, which is located in the same building. 

Source: 

http://www.nwcn.com/home/?fId=149996665&fPath=/news/local&fDomain=10212 
For more stories, see items 2 and 29 
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National Monuments and Icons Sector 



Nothing to report 
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Dams Sector 



49. May 3, Kent Reporter - (Washington) Kent hearing examiner approves two Green 
River levee projects. The Kent, Washington land use hearing examiner approved two 
Green River levee projects proposed by the city public works department, according to 
the Kent Reporter May 3. The projects include the State Route 516 to South 231st Way 
Levee, and the Boeing Levee. The projects are part of a larger effort by the city to have 
the entire levee system within city limits accredited by the Federal Emergency 
Management Agency (FEMA) to remove properties behind the levee from FEMA flood 
maps, and to reduce development restrictions and flood insurance requirements in the 
Kent Valley. 

Source: http : //w w w .kentreporter . com/new s/15 0048205 .html 
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